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Abstract — Due to the rapid development of the Internet in 
recent years, the need to find new tools to reinforce trust and 
security through the Internet has became a major concern. The 
discovery of new pseudo-random number generators with a 
strong level of security is thus becoming a hot topic, because 
numerous cryptosystems and data hiding schemes are directly 
dependent on the quality of these generators. At the conference 
Internet'09, we have described a generator based on chaotic 
iterations, which behaves chaotically as defined by Devaney. In 
this paper, the proposal is to improve the speed and the security 
of this generator, to make its use more relevant in the Internet 
security context. To do so, a comparative study between various 
generators is carried out and statistical results are given. Finally, 
an application in the information hiding framework is presented, 
to give an illustrative example of the use of such a generator in 
the Internet security field. 

Aeyworrfi -Internet security; Chaotic sequences; Statistical 
tests; Discrete chaotic iterations; Information hiding. 

I. Introduction 

The development and popularity of the Internet, and its 
recent role in everyday life implies the need to protect data 
and privacy in digital world. This development has revealed 
new major security issues. For example, new concerns have 
recently appeared with the evolving of the Internet, as evoting, 
VoD or intellectual property protection. The pseudo-random 
number generators (PRNG) play an important role in all of 
these emerging techniques, because they are fundamental in 
cryptosystems and information hiding schemes. PRNGs are 
typically defined by a deterministic recurrent sequence in 
a finite state space, usually a finite field or ring, and an 
output function mapping each state to an input value. This is 
often either a real number in the interval (0,1) or an integer 
in some finite range fSl. Conventionally, PRNGs based on 
linear congruential methods and feedback shift-registers are 
popular 161 . 

To use a PRNG with a large level of security is necessary to 
satisfy the Internet security requirements recalled above. This 
level depends on the proof of theoretical properties and results 
of numerous statistical tests. Many PRNGs have been proven 
to be secure, following a probabilistic approach. However, 
recently, several researchers have been exploring the idea of 
using chaotic dynamical systems for this purpose jS] |[3l- The 
random-like, unpredictable dynamics of chaotic systems, their 
inherent determinism and simplicity of realization suggest 
their potential for exploitation as PRNGs. Such generators 
can strongly improve security in information hiding and 
cryptography: due to unpredictability, the possibilities offered 
to an attacker to achieve his goal are drastically reduced. For 
example the keys of cryptosystems need to be unpredictable 
enough, making it impossible for any search optimization 
based on the reduction of the key space to the most probable 
values. But the number of generators claimed as chaotic. 



which actually have been proven to be unpredictable (as it 
is defined in the mathematical theory of chaos) is very small. 

This paper extends a study initiated in ID and ifTJI , and 
tries to fill this gap. In 121, it is proven that chaotic iterations 
(CIs), a suitable tool for fast computing iterative algorithms, 
satisfies the topological chaotic property, as it is defined by 
Devaney Q. In the paper lT3l presented at Internet'09, the 
chaotic behavior of CIs is exploited in order to obtain an 
unpredictable PRNG, which depends on two logistic maps. 
We have shown that, in addition of being chaotic, this gener- 
ator can pass the NIST (National Institute of Standards and 
Technology of the U.S. Government) battery of tests IfTTI . 
widely considered as a comprehensive and stringent battery of 
tests for cryptographic applications. In this paper, we have im- 
proved the speed and security of the former generator Chaotic 
properties, statistical tests and security analysis fT4| allow 
us to consider that this generator has good pseudo-random 
characteristics and is capable to withstand attacks. Moreover, 
its high linear complexity and its large key space lead to the 
conviction that this generator is suitable for applications in the 
Internet security field. After having presented the theoretical 
framework of the study and a security analysis, we will give 
a comparison based on statistical tests. Finally a concrete 
example of how to use these pseudo-random numbers for 
information hiding through the Internet is detailed. 

The rest of this paper is organized in the following way. In 
Section|II] some basic definitions concerning chaotic iterations 
and PRNGs are recalled. Then, the generator based on discrete 
chaotic iterations is presented in Section |III] Section |IV] is 
devoted to its security analysis. In Section |Vl various tests are 
passed with a goal to achieve a statistical comparison between 
this new PRNG and other existing ones. In Section |Vll a 
potential use of this PRNG in some Internet security field is 
presented, namely in information hiding. The paper ends with 
a conclusion and intended future work. 



II. Basic recalls 



A. Notations 
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M*— the set of positive integers {1,2,3,...} 
B. Chaotic iterations 

Definition 1 The set B denoting {0, 1}, let / : B'^ — > 
be an "iteration" function and 5 e § be a chaotic strategy. 
Then, the so-called chaotic iterations are defined by lfT2l 
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(1) 

In other words, at the n*'' iteration, only the 5"— th cell is 
"iterated". Chaotic iterations generate a set of vectors (boolean 
vectors in this paper), which are defined by an initial state x^, 
an iteration function /, and a chaotic strategy S. 

C. XORshift 

XORshift is a category of very fast PRNGs designed by 
George Marsaglia ||9l. It repeatedly uses the transform of 
exclusive or (XOR) on a number with a bit shifted version 
of it. The state of a XORshift generator is a vector of bits. 
At each step, the next state is obtained by applying a given 
number of XORshift operations to w-hit blocks in the current 
state, where w = 32 or 64. A XORshift operation is defined 
as follows. Replace the w-bit block by a bitwise XOR of the 
original block, with a shifted copy of itself by a positions 
either to the right or to the left, where < a < w. This 
Algorithm □ has a period of 2^2 - 1 = 4.29 x 10^. 

Input: the internal state z (a 32-bits word) 
Output: y (a 32-bits word) 

z ^ z © (z < 13); 
z ^ z © (z > 17); 
z ^ z© (z < 5); 

return y; 

Algorithm 1: An arbitrary round of XORshift algorithm 



III. The new generation of CI pseudo-random 

SEQUENCE 

A. Chaotic iterations as pseudo-random generator 

1) Presentation: The novel generator is designed by the 
following process. First of all, some chaotic iterations have 
to be done to generate a sequence {x"')^^-^ G (B'^) 
(N G IN*,N ^ 2, is not necessarily equal to 32) of 
boolean vectors, which are the successive states of the iterated 
system. Some of these vectors will be randomly extracted 
and our pseudo-random bit flow will be constituted by their 
components. Such chaotic iterations are realized as follows. 
Initial state x° G B'^ is a boolean vector taken as a seed (see 
Section HILAB and chaotic strategy (5'")„g„ G |1, N]'^ is an 
irregular decimation of a XORshift sequence (Section riII-A4l i. 
The iterate function / is the vectorial boolean negation: 



/o : G B^ ^ ixT,.:,x^) G B^ 

At each iteration, only the S'*-th component of state 

updated, as follows: xf = x^^^ if i ^ S\ else = x'^"'^. 
Finally, some a;" are selected by a sequence m" as the 
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pseudo-random bit sequence of our generator. The sequence 
(m")„giN G Ai^ is computed fr om a X ORshift sequence 
(2/")riG]N G |0, 232-1]] (see Section IIlLA3] l. So, the generator 
returns the following values: 
Bits: 



mo mo mo 



or States: 



mo ^mo+mi ^mo + mi 



'1 



mo+mi mo+mi+77i2 



'1 



2) The seed: The initial state of the system x'^ and the 
first term y° of the XORshift are seeded either by the current 
time in seconds since the Epoch, or by a number that the user 
inputs, as it is usually the case for every PRNG. 

3) Sequence m of returned states: The output of the 
sequence (?;") is uniform in [0, 2'^2_x], because it is produced 
by a XORshift generator However, we do not want the output 
of (m") to be uniform in |0,A^|, because in this case, the 
returns of our generator will not be uniform in [0,2^ — 1], 
as it is illustrated in the following example. Let us suppose 
that x° = (0, 0, 0). Then m" G lO, 3]. 

• If mP = 0, then no bit will change between the first and 
the second output of our PRNG. Thus x^ = (0, 0, 0). 

« If m*' = 1, then exactly one bit will change, which leads 
to three possible values for x^, namely (1, 0, 0), (0, 1, 0), 
and (0,0,1). 

« etc. 

As each value in 10,2^ — 1] must be returned with the same 
probability, then the values (0,0,0), (1,0,0), (0,1,0) and 
(0,0, 1) must occur for with the same probability. Finally 
we see that, in this example, rn" = 1 must be three times more 
probable than to° = 0. This leads to the following general 
definition for to: 
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(2) 

4) Chaotic strategy: The chaotic strategy {S'') G |1, A^]"^ 
is generated from a second XORshift sequence {b'^) G 
|1, A]'^. The sole difference between the sequences S and 
b is that some terms of b are discarded, in such a way that: 



Vfc G K,{S'' ,S^' +\...,S^'' 
same integer twice, where - 



^ ) does not contain a 
J2i=o Therefore, no bit 
will change more than once between two successive outputs 
of our PRNG, increasing the speed of the former generator 
by doing so. S is said to be "an irregular decimation" of b. 
This decimation can be obtained by the following process. 

Let (d^, d^, . . . , d^) G {0, 1}^ be a mark sequence, such 
that whenever X^iLi ^ '^^en Vz,di = (Vfc, the 
sequence is reset when d contains m'^ times the number 1). 
This mark sequence will control the XORshift sequence b as 
follows: 

. if d''' ^ 1, then S'' = b>, d^' = 1 and fc = fc + 1 

• if d''^ = 1, then V is discarded. 
For example, if & = 1422334142112234... and m ^ 4241..., 
then S = 1423 34 1423 4... Another example is given in 
Table III-CI in which r means "reset" and the integers which 
are underlined in sequence b are discarded. 



B. CI(XORshift, XORshift) algorithm 

The basic design procedure of the novel generator is 
summed up in Algorithm |2] The internal state is x, the 
output state is r. a and b are those computed by the two 
XORshift generators. The value /(a) is an integer, defined as 
in Equation |2] Lastly, N is a constant defined by the user. 

Input: the internal state x (N bits) 
Output: a state r of N bits 
for i = 0, . . . , iV do 
I d,^0; 
end 

a ^ XORshiftl{); 
m ^ /(a); 
fc ^ to; 

for i = 0, . . . , fc do 

b ^ XORshift20 mod N; 
S ^b; 

it ds = then 

xs ^ 
ds^l; 

end 

else if = 1 then 

I k ^ k + 1; 
end 

end 

r x; 
return r; 

Algorithm 2: An arbitrary round of the new 
CI(XORshift,XORshift) generator 

As a comparison, the basic design procedure of the old 
generator is recalled in Algorithm [3] (a and b are computed 
by Logistic maps, N and c ^ 3N are constants defined by the 
user). See ifTSl for further informations. 

Input: the internal state x (N bits) 
Output: a state r of N bits 
a i~ LogisticmaplQ; 
if a > 0.5 then 

I d^l 
end 
else 

I d^O 
end 

m <— d + c; 

for i = 0, . . . , TO do 

b -i— Logisticmap2{); 
S ^ 100000& mod N; 

xs ^ 

end 

return r; 

Algorithm 3: An arbitrary round of the old PRNG 

C. Illustrative example 

In this example, N = 4 is chosen for easy understanding. 
The initial state of the system x^ can be seeded by the decimal 
part t of the current time. For example, if the current time 



in seconds since the Epoch is 1237632934.484088, so t = 
484088, then x^ = t (mod 16) in binary digits, i.e., a;° = 
(0,1,0,0). 

To compute to sequence. Equation [3] can be adapted to this 
example as follows: 
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where y is generated by XORshift seeded with the current 
time. We can see that the probabilities of occurrences of to = 

0, TO = 1, TO = 2, TO = 3, TO = 4, are 4=-, th, 

16 16 16 16 16 

respectively. This to determines what will be the next output 
X. For instance, 

. If TO = 0, the following x will be (0, 1, 0, 0). 

. If TO = 1, the following x can be (1, 1, 0, 0), (0, 0, 0, 0), 
(0,1,1,0) or (0,1,0,1). 

. If TO = 2, the following x can be (1,0,0,0), (1, 1,1,0), 
(1,1,0,1), (0,0,1,0), (0,0,0,1) or (0,1,1,1). 

. If TO = 3, the following x can be (0, 0, 1, 1), (1, 1, 1, 1), 
(1,0,0,1) or (1,0,1,0). 

• If TO = 4, the following x will be (1, 0, 1, 1). 

In this simulation, to = 0,4,2,2,3,4,1,1,2,3,0,1,4,... 
Additionally, b is computed with a XORshift genera- 
tor too, but with another seed. We have found b = 
1,4,2,2,3,3,4,1,1,4,3,2,1,... 

Chaotic iterations are made with initial state x", vectorial 
logical negation /o and strategy S. The result is presented in 
Table H] Let us recall that sequence to gives the states x" to 
return, which are here x'^'^'^, a;°+''+^, . . . So, in this exam- 
ple, the output of the generator is: 101001 111011111 1001 1... 
or 4,4,11,8,1... 

IV. Security analysis 

A. Key space 

The PRNG proposed in this paper is based on discrete 
chaotic iterations. It has an initial value x° € B'^. Considering 
this set of initial values alone, the key space size is equal to 
2'^. In addition, this new generator combines digits of two 
other PRNGs. We used two different XORshifts here. Let k 
be the key space of XORshift. So the total key space size is 
close to 2'^ • fc^. Lastly, the impact of Equation [2] must be 
taken into account. This leads to conclude that the key space 
size is large enough to withstand attacks. 

B. Devaney's chaos property 

Generally, the quality of a PRNG depends, to a large extent, 
on the following criteria: randomness, uniformity, indepen- 
dence, storage efficiency, and reproducibility. A chaotic se- 
quence may satisfy these requirements and also other chaotic 
properties, as ergodicity, entropy, and expansivity. A chaotic 
sequence is extremely sensitive to the initial conditions. That 
is, even a minute difference in the initial state of the system 
can lead to enormous differences in the final state, even 
over fairly small timescales. Therefore, chaotic sequence fits 
the requirements of pseudo-random sequence well. Contrary 
to XORshift, our generator possesses these chaotic proper- 
ties ll2l. lfT3l . However, despite a large number of papers pub- 
lished in the field of chaos-based pseudo-random generators. 
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Binai-y Output; x'lx'^x'^xlx°x'-^x^x'lxfxix^xfxlx^... = 01000100101110000001... 
Integer Output: x^ ,x^ ,x*, x^,x^... = 4, 4, 11,8, 1... 

Table I: Application example 
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Sensitivity analysis 
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Figure 1: Sensitivity analysis 



the impact of this research is rather marginal. This is due 
to the following reasons: almost all PRNG algorithms using 
chaos are based on dynamical systems defined on continuous 
sets {e.g., the set of real numbers). So these generators are 
usually slow, requiring considerably more storage space and 
lose their chaotic properties during computations. These major 
problems restrict their use as generators Q. 
In this paper we don't simply integrate chaotic maps hoping 
that the implemented algorithm remains chaotic. Indeed, the 
PRNG we conceive is just discrete chaotic iterations and we 
have proven in ||2l that these iterations produce a topological 
chaos as defined by Devaney: they are regular, transitive, 
and sensitive to initial conditions. This famous definition 
of a chaotic behavior for a dynamical system implies un- 
predictability, mixture, sensitivity, and uniform repartition. 
Moreover, as only integers are manipulated in discrete chaotic 
iterations, the chaotic behavior of the system is preserved 
during computations, and these computations are fast. 

C. Key sensitivity 

As a consequence of its chaotic property, this PRNG is 
highly sensitive to the initial conditions. To illustrate this 
property, several initial values are put into the chaotic system. 
Let H be the number of differences between the sequences 
obtained in this way. Suppose n is the length of these 
sequences. Then the variance ratio P, defined by P = H/n, 
is computed. The results are shown in Figure [T] {x axis is 
sequence lengths, y axis is variance ratio P). For the two 
PRNGs, variance ratios approach 0.50, which indicates that 
the system is extremely sensitive to the initial conditions. 



V. Statistical analysis 

A. Basic usual tests 

1 ) Comparative test parameters: In this section, five well- 
known statistical tests ifTOl are used as comparison tools. 
They encompass frequency and autocorrelation tests. In what 
follows, s = s'^ , , s'^ , . . . , s"^^ denotes a binary sequence of 
length n. The question is to determine whether this sequence 
possesses some specific characteristics that a truly random 
sequence would be likely to exhibit. The tests are introduced 
in this subsection and results are given in the next one. 

Frequency test (monobit test): The purpose of this test 
is to check if the numbers of O's and I's are approximately 
equal in s, as it would be expected for a random sequence. Let 
no, Til denote these numbers. The statistic used here is Xi ~ 
, which approximately follows a distribution with 
one degree of freedom when n ^ 10^. 

Serial test (2-bit test): The purpose of this test is to 
determine if the number of occurrences of 00, 01, 10 and 
11 as subsequences of s are approximately the same. Let 
n^oo, 'T-oi, JT-io, and nn denote the number of occurrences of 
00,01, 10, and 11 respectively. Note that noo + n^i + "-lo + 
nil = n — 1 since the subsequences are allowed to overlap. 
The statistic used here is: 
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^01 + "?o + - K'^o + ) + 1' which 
distribution with 2 degrees of 



approximately follows a x" 
freedom if n ^ 21. 

Poker test: The poker test studies if each pattern of 
length m (without overlapping) appears the same number of 
times in s. Let I — I 5 x 2™ and fc = I — I . Divide the 
sequence s into k non-overlapping parts, each of length m. Let 
rii be the number of occurrences of the i*'* type of sequence 
of length m, where 1 ^ i ^ 2™. The statistic used is 



X. = — 




which approximately follows a x^ distribution with 2'" — 1 
degrees of freedom. Note that the poker test is a generalization 
of the frequency test: setting m = 1 in the poker test yields 
the frequency test. 

Ruyis test: The purpose of the runs test is to figure out 
whether the number of runs of various lengths in the sequence 
s is as expected, for a random sequence. A run is defined as 
a pattern of all zeros or all ones, a block is a run of ones, 
and a gap is a run of zeros. The expected number of gaps 
(or blocks) of length i in a random sequence of length n is 



Table III: SP 800-22 test results (Ft) 
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Figure 2: Comparison through various well-known tests 
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= . Let be equal to the largest integer i such that 

Ci ^ 5. Let Bi , Gi be the number of blocks and gaps of length 
i in s, for each i £ The statistic used here will then 

be: 
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which approximately follows a distribution with 2k — 2 
degrees of freedom. 

Autocorrelation test: The purpose of this test is to check 
for coincidences between the sequence s and (non-cyclic) 
shifted versions of it. Let ci be a fixed integer, 1 ^ c? ^ ["^/^J • 
The A{d) = J27=o~^ © ^i+d is the amount of bits 
not equal between the sequence and itself displaced by d 
bits. The statistic used is: X5 = 2{A{d) - '-^)/Vn - d, 
which approximately follows a normal distribution N{Q, 1) if 
n — d ^ 10. Since small values of A{d) are as unexpected as 
large values, a two-sided test should be used. 

2) Comparison: We show in Table a comparison be- 
tween our new generator CI(XORshift, XORshift), its old 
version denoted Old CI(Logistic, Logistic), a PRNG based 
on logistic map, and a simple XORshift. Time (in seconds) is 
related to the duration needed by each algorithm to generate a 
2 X 10^ bits long sequence. The test has been conducted using 
the same computer and compiler with the same optimization 
settings for both algorithms, in order to make the test as fair 
as possible. Similar results have been achieved for different 
sequence lengths (see Figure |2l). The results confirm that the 
proposed generator is a lot faster than the old one, while the 
statistical results are better for most of the parameters, leading 
to the conclusion that the new PRNG is more secure than the 
old one. Although the logistic map also has good results, it 
is too slow to be implemented in Internet applications. 



B. NIST statistical test suite 
Among the 



standard tests for pseudo- 
way to prove the quality of 



numerous 
randomness, a convincing 
the produced sequences is to confront them with the NIST 
(National Institute of Standards and Technology) Statistical 
Test Suite SP 800-22, released by the Information Technology 
Laboratory in August 25, 2008. This package of 15 tests 




(a) The original image (b) The watermark 

Figure 3: Original images 



was developed to measure the randomness of (arbitrarily 
long) binary sequences produced by either hardware or 
software based cryptographic (pseudo-)random number 
generators. These tests focus on a variety of different types 
of non-randomness that could occur in such sequences. 

In our experiments, 100 sequences (s = 100) of 1,000,000 
bits are generated and tested. If the value of any test is 
smaller than 0.0001, the sequences are considered to not be 
good enough and the generator is unsuitable. Table Hill shows 
Ft of the sequences based on discrete chaotic iterations using 
different schemes. If there are at least two statistical values 
in a test, this test is marked with an asterisk and the average 
value is computed to characterize the statistical values. We 
can conclude from Table [III] that both the old generator and 
CI(XORshift, XORshift) have successfully passed the NIST 
statistical test suite. 

VI. Application example in digital watermarking 

In this section, an application example is given in the 
field of digital watermarking: a watermark is encrypted and 
embedded into a cover image using the scheme presented 
in fD and CI(XORshift, XORshift). The carrier image is the 
well-known Lena, which is a 256 grayscale image, and the 
watermark is the 64 x 64 pixels binary image depicted in 
Figure [3] 

The watermark is encrypted by using chaotic iterations: the 
initial state is the watermark, considered as a boolean vec- 
tor, the iteration function is the vectorial logical negation, and 



Table II: Comparison with Old CI(Logistic, Logistic) for a 2 x 10^ bits sequence 
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Figure 4: Encrypted watermark and differences 

the chaotic strategy {S'')ke'K is defined with CI(XORshift, 
XORshift), where initial parameters constitute the secret key 
and N = 64. Thus, the encrypted watermark is the last 
boolean vector generated by these chaotic iterations. An 
example of such an encryption is given in Figure |4] 

Let L be the 256^ booleans vector constituted by the three 
last bits of each pixel of Lena and defined by: 

ft/" =5" 

\ = + 2 X J7" + n [mod 256^] ^ ' 

The watermarked Lena /„, is obtained from the original Lena, 
whose three last bits are replaced by the result of 64^ chaotic 
iterations with initial state L and strategy U (see Figure |4]i. 

The extraction of the watermark can be obtained in the 
same way. Remark that the map 9 i-^ 29 of the torus, 
which is the famous dyadic transformation (a well-known 
example of topological chaos IH), has been chosen to make 
{U'')k^Q42 highly sensitive to the strategy. As a consequence, 
(f^'^)/c<642 is highly sensitive to the alteration of the image: 
any significant modification of the watermarked image will 
lead to a completely different extracted watermark, thus giving 
a way to authenticate media through the Internet. 

VII. Conclusion and future work 

In this paper, the pseudo-random generator proposed in ifTSl 
has been improved. By using XORshift instead of logistic 
map and due to a rewrite of the way to generate strategies, 
the generator based on chaotic iterations works faster and is 
more secure. The speed and randomness of this new PRNG 
has been compared to its former version, to XORshift, and to 
a generator based on logistic map. This comparison shows that 
CI(XORshift, XORshift) offers a sufficient speed and level of 
security for a whole range of Internet usages as cryptography 
and data hiding. 

In future work, we will continue to try to improve the speed 
and security of this PRNG, by exploring new strategies and 
iteration functions. Its chaotic behavior will be deepened by 
using the various tools provided by the mathematical theory 
of chaos. New statistical tests will be used to compare this 
PRNG to existing ones. Additionally a probabilistic study of 



its security will be done. Lastly, new applications in computer 
science will be proposed, especially in the Internet security 
field. 
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